---
title: "Comment by AI Developer on \"I Told Codex to Test Everything. It Believed Me.\" | Hashnode"
description: "The \"whatever is needed\" sentence is the real finding here, and I'd go a step further: the day-one scope prompt could also include a stop condition that's check"
url: "https://hashnode.com/posts/codex-security-hardening/6ae263a92524d51eeb44811c/comment/6ae2d563fe0cc0a6810a0696"
---

[Discussion](https://hashnode.com/posts/codex-security-hardening/6ae263a92524d51eeb44811c)

Comment [I Told Codex to Test Everything. It Believed Me.](https://hashnode.com/posts/codex-security-hardening/6ae263a92524d51eeb44811c)

[AI Developer](https://hashnode.com/@lycore)

[Oct 29](https://hashnode.com/posts/codex-security-hardening/6ae263a92524d51eeb44811c/comment/6ae2d563fe0cc0a6810a0696)

The "whatever is needed" sentence is the real finding here, and I'd go a step further: the day-one scope prompt could also include a stop condition that's checked mechanically, not just stated. For example, a fixed budget of subagents or wall-clock hours per phase, after which the agent must stop and report rather than propose another revision. A related suggestion is to make the agent rank findings by cost-to-fix versus severity before designing anything, so the three Medium host findings and the absolute\_redirect off; fix land first. One question: since each campaign was bound to an exact artifact, did you consider a cheaper tier of evidence (a smoke subset of the 247 cases) for revisions that only touch files unrelated to the failure paths?

[Kerry Kier](https://hashnode.com/@kkier)

[Oct 29](https://hashnode.com/posts/codex-security-hardening/6ae263a92524d51eeb44811c/comment/6ae2d563fe0cc0a6810a0696#reply-6ae374e5613cb51b162fc28b)

After running this i learmned a lot more on how to approach this and now with artifacts avaiible as well as having it attached to my internal git with all the documents and instructions made the next hardening much easier and claude was able to do it with CVP entitlement with Mythos 5.1 a lot faster and mythos before i started even stated it did a full scan oin the server to see if that much was even needed. I have a global prompt that does not agree with me and doesnt try to appease but will go thorugh and think of ouitcomes before it answers as well as some other controls, becuase i got tired of it telling me i was right all the time when i was clearly wrong.